Carried first-edition guidance. The CSC asks the CSP for information on how it manages technical vulnerabilities that can affect the services provided, determines which vulnerabilities it must manage itself, and sets a clear process for them; the CSP makes that information available.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.